Computing networks are becoming ubiquitous in enterprises, providing secure and cost-effective access to resources. Those networks usually have a plurality of network devices, such as routers, network switches, wireless access points (AP), firewalls, servers, etc. deployed through the network. The network devices enable the exchange of data and/or services between network devices, as well as with other networks and devices outside of the network. In order to meet the demands of enterprises, an enterprise may deploy multiple physical computing networks at a single location, may logically divide a single network into different network segments, may deploy multiple physical or logical networks at different physical locations, as well as other network deployment configurations.
Not all network content, however, is innocuous or legitimate network content. Due to the extensive use of computer networks by enterprises, there has been a dramatic rise in network attacks, a proliferation of computer viruses, and a constant distribution of other types of malicious content that attempts to attack, infect, or otherwise infiltrate the computer networks. One approach for combating network threats is the deployment of a threat monitoring server within a segment of a computing network. The threat monitoring server is a physical or virtual server deployed in the network segment that emulates a production server within the network. That is, the threat monitoring server emulates a real world server and server applications of a production server within the network segment. By emulation of a production server in a network segment, potentially harmful network content can be routed to, tested, and analyzed within the network segment by the threat monitoring server to detect potential attacks. However, the threat monitoring server only operates in that particular network segment to detect threats to that network segment.
The threat monitoring servers are designed to receive and contain attacks or threats without affecting other production servers on the network. However, deploying threat-monitoring servers in all network segments, in different logical sections of a network, in different physical networks, etc. is costly. It requires many threat monitoring servers running various applications to be deployed on all network segments. Furthermore, additional deployment efforts and cost are required when new network segments are added. This problem is exacerbated in virtualized data centers, where new logical network segments are constantly added and removed.
A hardware firewall is a network security system that controls incoming and outgoing network traffic. A hardware firewall generally creates a barrier between an internal network (assumed to be trusted and secure) and another network (e.g., the Internet) that is assumed not to be trusted and secure.
Attackers breach internal networks to steal critical data. For example, attackers target low-profile assets to enter the internal network. Inside the internal network and behind the hardware firewall, attackers move laterally across the internal network, exploiting East-West traffic flows, to critical enterprise assets. Once there, attackers siphon off valuable company and customer data.